Privacy Policy
Our commitment to protecting your privacy and personal data
Last updated: December 1, 2024
Table of Contents
Introduction
Eduline's Privacy Policy rests on the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission (NPC).\n\nEduline ("Eduline", "we", "us", or "our") connects learners across the Philippines, and the people who sign them up, with private tutors. In doing so we act as a personal information controller under RA 10173. This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you hold over it.\n\nAll processing described here is meant to satisfy the three principles the Act imposes: **transparency** (you know the nature, purpose and extent of the processing, and how to act on it), **legitimate purpose** (the purpose is declared, specified, and not contrary to law, morals or public policy), and **proportionality** (what we process is adequate, relevant, necessary, and not excessive for that purpose).\n\nOne point belongs at the top: our learners range from young children to working adults, and many of them are minors. Philippine law treats a minor’s data as a special case, and so do we; see "Children's Data" below.
1. Information We Collect
We collect only what a tutoring match and the sessions that follow actually require. Where a field is optional we say so at the point of collection, and declining it does not block you from using the service.
Account and contact details
Name, email address, mobile number, and the city or barangay you want tutoring in. When someone else books for the learner (a sibling, partner or employer for an adult, or a parent or guardian for a child), these are that person’s own details.
Learner details
Grade or course level, school, subjects needed, and the goal the learner is working toward: catching up, a specific exam such as UPCAT or ACET, or ongoing support. For a learner who is a minor we ask only for a first name and an age band.
Tutoring and session records
Enquiries, match history, scheduled and completed sessions, attendance, and the feedback that learners, the people who booked for them, and tutors give afterwards. This is what lets us tell whether a match is working.
Payment details
Amounts, dates, and the reference numbers our payment provider returns. Card and e-wallet credentials are entered directly with the provider, and we never receive or store them.
Tutor applicant data
For people applying to teach: education and employment history, subjects and levels taught, government-issued identification for verification, and the results of the background checks a tutoring platform is expected to run. Some of this is sensitive personal information under Section 3(l) of the Act and is handled under the stricter rules that section imposes.
Technical and usage data
Pages viewed, searches run, device and browser type, and approximate location derived from IP address. Used to keep the site working and to improve it. We build no advertising profiles of learners.
2. How We Use Information
Each use below is a declared and specific purpose. We do not repurpose your data for something unrelated without asking you first, which is what the legitimate purpose principle requires.
Matching learners with tutors
The core service: reading what a learner needs and proposing tutors who actually teach that subject, at that level, in that area or online.
Delivering and supporting sessions
Scheduling, rescheduling, confirming attendance, passing progress notes from the tutor to the learner, or to the parent or guardian when the learner is a minor, and stepping in when a match is not working.
Payments and billing
Issuing invoices and receipts, processing payment through our provider, paying tutors, and keeping the accounting records Philippine tax and commercial law requires us to keep.
Safety and verification
Verifying tutor identity and credentials, and investigating conduct reports. A tutoring platform that skips this is not safe for children, so this processing is necessary for the service itself.
Service improvement
Understanding which subjects and levels are in demand and where matches break down, so we can fix them. Aggregated wherever aggregation answers the question.
Marketing, only if you opt in
Study tips, exam-season reminders, and service news, sent only where you have given separate, specific consent for it, and withdrawable at any time through the unsubscribe link or by writing to our Data Protection Officer. Consent to marketing is never bundled into consent to use the service.
3. Information Sharing
We disclose personal data only where the disclosure is necessary for a purpose set out above, required by law, or specifically consented to. We do not sell personal data, and we do not trade it for advertising.
With the tutor matched to you
A tutor receives what they need to teach: the learner’s first name, grade level, subject and goals, session location or link, and the booking contact. They do not receive payment details or your full enquiry history.
With service providers acting for us
Payment processing, email delivery, hosting, and analytics. These act as personal information processors under our written instruction, are bound to confidentiality and to security measures no weaker than our own, and may not use the data for their own purposes.
With the people who run our operations
Limited operational sharing with the team that runs a function for Eduline, for example tutor vetting, under the same confidentiality that binds our own staff. Nobody receives Eduline learner data for their own marketing.
Where the law requires it
In response to a lawful order, subpoena, or a legitimate request from the NPC or another authority with jurisdiction. We satisfy ourselves that a request is valid before acting on it, and tell you where we are permitted to.
Cross-border transfers
Some providers process data outside the Philippines. Where that happens we remain accountable for it under the Act, and require contractual protection comparable to what RA 10173 provides. Each provider, and the country where it processes data, is named on this page before any personal data reaches it.
4. Data Security
The Act and its IRR require organisational, physical, and technical measures, and we structure our controls the same way. No system is perfectly secure, so this section describes both what we do and what we do when something fails.
Organisational measures
A Data Protection Officer accountable for compliance, access granted on a need-to-know basis, confidentiality undertakings from staff and tutors, and privacy training for anyone who touches learner data.
Technical measures
Encryption in transit, encryption at rest for sensitive fields, authentication on every administrative surface, logging of access to learner records, and regular review of who holds which permission.
Physical measures
Access control over any premises and device holding personal data, and secure disposal of records at the end of their retention period.
If a breach happens
Where a personal data breach is likely to give rise to a real risk of serious harm, we notify the National Privacy Commission within seventy-two (72) hours of knowledge or reasonable belief, as NPC Circular 16-03 requires, and notify affected data subjects. A full report follows within five (5) days unless the Commission grants more time. We do not delay notification to finish investigating.
5. Your Rights as a Data Subject
Sections 16 to 18 of RA 10173 give you the following rights over the personal data we hold about you. Exercise any of them by writing to our Data Protection Officer using the contact details below, free of charge and without needing to give a reason.
To be informed
To know that your personal data is being or will be processed, and for what purpose, before it happens.
To access
To obtain a copy of the personal data we hold about you, along with how it was processed, the sources it came from, the recipients it went to, and the reasons for any disclosure.
To object
To refuse processing, including processing for direct marketing or automated decision-making. Where you object, we stop, unless we are under a legal obligation to continue.
To rectify
To have inaccurate or outdated data corrected, and to have the correction passed on to anyone we had already disclosed it to.
To erasure or blocking
To have us suspend, withdraw, or remove personal data that is incomplete, outdated, false, unlawfully obtained, used for an unauthorised purpose, or no longer necessary for the purpose it was collected for.
To damages
To be indemnified for damage suffered because of inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorised use of your personal data.
To data portability
Under Section 18, where we process your data electronically in a structured and commonly used format, to obtain a copy in a format that lets you move it elsewhere.
Transmissibility, and complaints
Under Section 17 these rights may be invoked by your lawful heirs and assigns after death or incapacity. And if our answer does not satisfy you, you may complain directly to the National Privacy Commission at any time, on your own initiative.
6. Cookies and Tracking
We use cookies and similar technologies sparingly, and we distinguish between the ones the site cannot work without and the ones you can decline.
Strictly necessary
Session handling, security, and remembering your language and consent choices. These cannot be switched off without breaking the site.
Analytics
Aggregated measurement of which pages are read and where journeys stall. Set only where you have accepted them, and configured to avoid identifying individual learners.
Your control
You can withdraw cookie consent at any time through your browser settings or our cookie controls. Declining analytics does not degrade the service.
7. Data Retention
We keep personal data only while it serves the purpose it was collected for, or while a law requires us to keep it, whichever is longer, and then we dispose of it securely.
Active accounts and enquiries
Kept while the account is in use, and for a limited period afterwards so a returning learner does not have to start over.
Financial records
Invoices, receipts, and payment references are kept for the period Philippine tax and commercial law prescribes, regardless of account closure.
Tutor vetting records
Verification and background-check results are kept while the tutor is active, and for a defined period afterwards so that a conduct history is not lost by deactivation.
Retention schedule
The period for each category above, as a number of months or years, is printed on this page before Eduline keeps any data under that category.
8. Children's Data
Most Eduline learners are minors, which places this service in the most protected tier of Philippine data privacy law. This section sets binding limits on how the product is built.
Parental consent is required
A person below eighteen (18) cannot give valid consent to the processing of their personal data under Philippine law. Where consent is our basis for processing a child’s data, we obtain it from a parent or guardian. The account is always held by the adult.
We collect the minimum about children
First name, age band, grade level, subjects, and progress notes: enough to teach well. We do not ask children for identity documents, home address, or contact details of their own, and tutors reach a learner through the parent’s contact.
Child-oriented transparency
The NPC’s 2024 Guidelines on Child-Oriented Transparency expect the age range of likely users (bands of 0–5, 6–12, and 13–17) to shape every privacy decision, with the strongest protection for children under 13. Where we speak to a learner directly, we do it in language that learner can actually understand.
Child Privacy Impact Assessment
The same Guidelines require a Child Privacy Impact Assessment for every product or service that processes children’s data. Eduline completes and files that assessment before processing a child’s data, and reviews it whenever the way we process a child’s data changes.
No marketing to children
We do not send marketing to a learner, profile a learner for advertising, or sell anything to a child. Marketing consent is a parent’s to give, about their own inbox.
Parents’ control
A parent or guardian may review, correct, or request deletion of their child’s data at any time by writing to our Data Protection Officer. We verify that the request comes from the parent before acting on it.
Policy Changes
We may update this Privacy Policy as the service develops or as Philippine law and NPC guidance change. The "last updated" date at the top of the page always reflects the current version. Where a change materially affects how we handle your data (a new purpose, a new category of recipient, a longer retention period), we tell you before it takes effect, and where the change requires fresh consent we will ask for it.
Contact Our Data Protection Officer
Questions about this policy, requests to exercise any of the rights above, or a privacy concern you want looked into all go to our Data Protection Officer. Under NPC rules the DPO is a member of Eduline’s own staff and is accountable for our compliance with RA 10173. If our response does not satisfy you, you may take the matter to the National Privacy Commission directly.
Response Time
We acknowledge every request within 7 business days and resolve it within the period prescribed by RA 10173 and NPC issuances. A complex request receives a written date for its answer at the moment we acknowledge it.
Address
Metro Manila, Philippines